How Shturval and Kubeflow are connected

ML platform on top of clusters and namespaces controlled by Shturval.

Roles of Helm and Kubeflow #

• Shturval manages the life cycle of Kubernetes clusters, namespaces, access rights, infrastructure providers and system services and integrates Kubeflow into the platform.
• Kubeflow provides tools for ML workflows in Kubernetes: notebooks, pipelines, experiments, runs/jobs, serving, training jobs, TensorBoard and viewers.

In this case:

• Kubeflow is deployed in a cluster as a set of components for ML workloads;
• the user’s workspace in Kubeflow is associated with a namespace created through a custom resource Profile of the API group kubeflow.org;
• the source of rights and access control remains Shturval: Kubeflow rights are specified in access sets and applied in target clusters.

Typical architecture #

A typical diagram looks like this:

• Kubeflow - installed on a cluster and publishes web interfaces through Istio Gateway and VirtualService;
• Profile Kubeflow - creates a custom namespace and includes Kubeflow components for it.

A typical Kubeflow installation uses the components Central Dashboard, Profiles, Jupyter/Notebook Controller, Kubeflow Pipelines, Katib, KServe, Knative Serving, Training Operator, Spark Operator, TensorBoard, PVC Viewer, and Volumes Web App. Kubeflow Pipelines uses Argo Workflows as a dependency to run workflows.

Profiles and namespaces #

A Kubeflow profile is a Profile resource of the kubeflow.org API group. The controller creates or maintains the user’s namespace and adds labels to it, which include integration with Kubeflow components such as Pipelines, KServe and Katib.

In the Shturval GUI, open Kubeflow from the namespace page created through a Kubeflow Profile. Since release 2.14, this entry point is available only from the namespace dashboard.

More information about the namespace dashboard: Namespace dashboard overview.

How Kubeflow permissions are applied #

Kubeflow permissions are set in permission sets. Roles supported:

• kubeflow-admin;
• kubeflow-view.

The permissions operator applies rights in the cluster:

• for namespace-level assignment, it creates a RoleBinding in the namespace and an Istio AuthorizationPolicy;
• for cluster or platform-level assignment, it applies rights to all namespaces that match the Kubeflow Profile and creates a ClusterRoleBinding;
• it expects ClusterRoles kubeflow-admin, kubeflow-edit, or kubeflow-view; Kubeflow supplies these roles — Shturval backend components do not create them.

Istio AuthorizationPolicy limits Kubeflow access by user or group. User access uses the kubeflow-userid header; group access uses token claims.

More details about roles: Setting permissions.

How to open Kubeflow from the Shturval GUI #

When Kubeflow is installed and running, and the namespace was created through a Profile resource, open Kubeflow from the GUI with SSO:

1. Select the cluster where Kubeflow is deployed.
2. Select the namespace created through Profile.
3. On the namespace page, click Kubeflow — the Kubeflow UI opens with platform SSO. Access to resources follows your assigned rights.

If the button is missing, verify that Kubeflow is running, the namespace was created via Kubeflow Profile, and a redirect link is configured.

When to use Kubeflow #

Kubeflow fits teams that need:

• isolated ML namespaces for users or teams;
• notebooks and pipeline workflows for experiments and model training;
• experiment, run/job, and artifact management;
• model serving via KServe/Knative;
• training jobs, Spark jobs, TensorBoard, and viewers in Kubernetes.

Kubeflow targets ML workflows on top of Kubernetes resources in a namespace.